How to make a WordPress backup the right way

What does a WordPress backup include?

WordPress keeps your site in two places, and a full WordPress backup copies both. As WordPress's own documentation puts it, you need both to fully restore a typical site.

• The files. Everything in the WordPress folder: your themes, plugins and uploaded media in wp-content, the wp-config.php file with your database details and security keys, and the .htaccess file with redirects and rules. WordPress core files can be downloaded again, but backing them up does no harm.
• The database. Usually MySQL or MariaDB, stored separately from the files. It holds posts, pages, revisions, comments, users and roles, settings, menus and widgets, data from plugins such as forms and SEO, and on WooCommerce, orders, customers and products.

Copying the files alone does not capture the database, and a database without its uploads restores a site full of broken images. One more trap: Tools > Export is not a backup. It creates an XML file of posts, pages, comments and users, but leaves out settings, themes, plugins and the media files themselves.

How often should you back up WordPress?

WordPress's documentation suggests weekly backups for smaller sites with few posts, daily backups for busy sites, and a backup before every upgrade or move. The right interval is really a question of how much work you could afford to lose:

• Brochure site that rarely changes: weekly, plus before every update.
• Blog or business site updated often: daily.
• Site taking enquiries or bookings all day: daily at least, more often if each enquiry matters.
• WooCommerce store: several times a day or in real time, because a restore loses every order placed since the last backup.

Whatever the schedule, take a fresh backup right before updates. A nightly backup can be almost a day old by the time an update breaks something. If WordPress updates itself, our guide to WordPress automatic updates explains when that happens.

Where to store WordPress backups: the 3-2-1 rule

A backup stored on the same server as the site is lost along with the server, and it is the first thing an attacker or a failed disk takes with it. The 3-2-1 rule, from US-CERT's "Data Backup Options" paper, is the standard answer:

• 3 copies of your data: the live site and two backups.
• 2 different types of storage, so one failure cannot take both.
• 1 copy off-site, away from your server and your office.

WordPress's documentation says much the same: keep at least three to five recent backups, in different places. Its hardening guide adds two good habits: encrypt backups, because they contain your users' data, and keep a record of which backups you have tested.

Way 1: Back up WordPress with a plugin

For most single sites, a backup plugin is the best balance of effort and safety. Install it once, choose a schedule and a remote destination, and it runs on its own.

To set one up:

1. Install the plugin from Plugins > Add New and activate it.
2. Choose separate schedules for files and the database. The database changes more often, so it can run more often.
3. Connect remote storage such as Google Drive, Dropbox or an S3 bucket. Do not leave backups only on the server.
4. Set how many backups to keep. Keep enough to go back further than the slowest problem you might miss, such as a hacked site found weeks later.
5. Run a first backup by hand and check that both parts arrived at the destination.

One limit to know: a plugin runs inside the site it protects. If the site is down, hacked or out of disk space, the backup can fail with it, and many plugins only report failures inside wp-admin.

Way 2: Use your host's WordPress backups

Most managed WordPress hosts back up every site daily at no extra cost, and many let you restore with one click.

Host backups are a useful safety net, but not a complete plan. They live with the same company that runs your server, retention is fixed by your plan, restores are often whole-site only, and they go away if you change host. Download a copy now and then, and keep at least one independent backup.

Way 3: Back up WordPress manually

A manual backup takes about ten minutes and needs no plugin. It is a good habit before a big change, and a way to back up WordPress without a plugin at all. Back up the database first, then the files.

1. Export the database. In phpMyAdmin, select the WordPress database, click Export, choose SQL format and include DROP TABLE statements. Or run wp db export from the site folder.
2. Download the files. Connect over SFTP and download the whole WordPress folder, including wp-content, wp-config.php and .htaccess.
3. Put copies in two more places. Keep one copy in cloud storage and one on a different device, never only on the web server.
4. Label and test. Name the backup with the site and date, and restore it to a test location to prove it works.

If you have SSH access, WP-CLI makes it faster:

# Database: writes a .sql file named after the database and today's date
wp db export

# Files: one archive of the whole WordPress folder
tar -czf site-files-2026-10-10.tar.gz /path/to/wordpress

To restore, put the files back first, then import the database with wp db import or phpMyAdmin. Our guide on how to restore a WordPress backup covers the order and the checks in detail. Manual backups are reliable, but only when someone remembers to do them, which is why they work best as an extra, not as the plan.

Way 4: Automatic WordPress backups for every site you manage

A plugin per site works until you have several sites. Then you have several plugins to update, several storage accounts to watch and several places a backup can fail without anyone noticing. A WordPress management platform backs up every connected site from outside, on infrastructure separate from the sites themselves.

WPCentrify is built that way. (Disclosure: WPCentrify is our product.) Its WordPress backups with verified restore are part of a WordPress website management platform that also handles updates, uptime, security and client reports:

Backups are included on every plan, and keeping backups in your own S3-compatible storage is on the roadmap. If you run more than a few sites, it is the same work as setting up one plugin, done once for all of them.

Which WordPress backup method should you use?

Most people combine two: their host's daily backups as a safety net, plus one method they control that keeps a copy off-site.

Test your WordPress backups by restoring them

A backup is only proven when it has been restored. The common failures are quiet: the plugin timed out partway through a large database, the storage filled up, a password expired and the schedule stopped, or the archive was never complete. None of these show up until the day you need the backup.

WordPress's own guidance recommends checking now and then that your automated backups actually work. Once a month, restore a recent backup to a test location, open the site, log in and check a few pages and recent content. Write down how long it took: that is your real recovery time, and the number a client will ask for after an incident.

WordPress backup checklist

Sources

• WordPress Backups, Backing up your files and Backing up your database, WordPress Advanced Administration Handbook
• wp db export and wp db import, WP-CLI documentation
• Tools Export Screen, WordPress.org documentation
• Data Backup Options, US-CERT (CISA)
• Plugin pages on WordPress.org: UpdraftPlus, Jetpack VaultPress Backup, Duplicator, BackWPup, BlogVault
• Host documentation: Kinsta, WP Engine, SiteGround

All sources checked on 10 October 2026.